fix(callgen): 跨模块裸名 CExport 调用精确解析返回类型，依赖未编译时 _deps_pending 重试，修复 malloc 返回截断 i32

App/lib/core/Gen/CallGenMixin.vp

@@ -746,6 +746,27 @@ class CallGenMixin(CallGenBase.CallGenBase):
                                     llvmlite.Ptr(pool, llvmlite.Int8(pool)))
             if vpi_ret_ty is not None:
                 call_ret_ty = vpi_ret_ty
+            elif mod_ret_sha1 is not None:
+                # 跨模块裸名 CExport 函数（如 mm.malloc → @malloc）：found_func=None
+                # 且 vpi 返回注解缓存未命中时，仍从依赖模块 text.ll/vpi 精确解析
+                # 返回类型（对齐 mangled 路径），避免静默默认 i32 截断指针/i64
+                # （uhci.vp mm.malloc 根因：call i32 @malloc 截断 0xbb69000 → null）。
+                # 依赖模块尚未编译（text.ll/vpi 均未生成）→ 标记 _deps_pending=1
+                # 下遍重试，本遍保持默认类型（Phase A 多遍收敛）。
+                cross_ret: llvmlite.LLVMType | t.CPtr = None
+                if trans is not None and trans._declare_only == 0:
+                    cross_ret = self._LookupMethodRetTyFromTextLL(
+                        pool, mod_ret_sha1, None, func_name, 1)
+                if cross_ret is None:
+                    cross_ret = self._lookup_method_ret_ty_via_vpi(
+                        pool, mod_ret_sha1, None, func_name)
+                if cross_ret is not None:
+                    call_ret_ty = cross_ret
+                else:
+                    if trans is not None and trans._declare_only == 0:
+                        if self._dep_text_ll_exists(pool, mod_ret_sha1) == 0:
+                            trans._deps_pending = 1
+                    call_ret_ty = self.Gen.CallGenLib._infer_external_func_ret_ty(pool, func_name)
             else:
                 call_ret_ty = self.Gen.CallGenLib._infer_external_func_ret_ty(pool, func_name)